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BRIEF IN REPLY TO EXAMINER'S 
ANSWER DATED DECEMBER 11, 2009 

This Reply Brief is being filed in response to the Examiner's Answer dated 

December 11, 2009. As set forth below, the Appellants respectfully reiterate their request 

for the Board to review and reverse the Examiner's two grounds of rejection. In the Final 

Office Action, the Examiner rejected independent claims I. 14. 19, 31, and 40. Claim 14 

was rejected as being directed to non-statutory subject matter under 35 U.S.C. § 101. 

Claims 1, 14, 19, 31, and 40 were rejected under 35 U.S.C. § 102(b) as being anticipated 

by European Patent No. 1,1 1 1,495 to Thompson (hereinafter "Thompson"). 

Claim 14 is directed to statutory subject matter 

The Examiner asserts that claim 14 is not patent-eligible subject matter because 
claim 14 recites means that the Examiner asserts are software per se. See Examiner's 
Answer, p. 1 1. However, the Examiner continues to overlook the computer system 
comprising the means of claim 14. As the Examiner correctly notes, the security module 
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may be one embodiment of the "means for controlling access to a secure computer 
resource," as recited in claim 14. However, as shown in Fig. 1, the security module is 
comprised within a computer system. See Application, Fig. 1. Specifically, the security 
module is comprised within a client that comprises a processor, a memory, an 
input/output controller, a storage device, and a network interface. See id., p. 3, 11. 7-13. 

The Appellants assert that the computer system recited in claim 14 is a machine, 
which is patent-eligible subject matter. See M.P.E.P. § 2106. Further, the computer 
system does not wholly embrace a judicially recognized exception. More specifically, 
the means recited in claim 14 are not an abstract idea, a law of nature, or a natural 
phenomenon. See id. Accordingly, claim 14 is directed to patent-eligible subject matter 
under 35 U.S.C. § 101. 

Claims 1, 14, 19, 31, and 40 are patentable over Thompson 

Claims 1, 14, 19, 31, and 40 are patentable over Thompson because Thompson 
does not disclose all of the limitations of claims 1, 14, 19, 31, and 40. Claim 1 recites 
controlling "access to a secure computer resource. . . based on verification of a security 

credential." Further, the user is enabled "to recover the security credential based on a 
response... associated with the verification data." As such, claim 1 recites 3 pieces of 
information: a security credential, a response, and verification data. Claims 14, 19, 31, 
and 40 recite similar limitations. 

Thompson does not disclose the security credential, the response, and the 
verification data recited by the present claims. Rather, a section cited to by the Examiner 
describes a password modification process. See Examiner's Answer, pp. 7, 16. In the 
password modification, a security card is connected to an I/O port. See Thompson, para. 
[0023]. The CPU retrieves a password from the security card, and compares the retrieved 
password against a locally stored password. See id. If there is a match, the CPU prompts 
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the user for a new password. See id. The new password is then encrypted. See id. The 
section discloses a password, a new password, and an encryption key. 

The Examiner cites to the password as being a security credential. See 
Examiner's Answer, pp. 6-7. However, neither the new password nor the encryption key 
is the response recited in the claims. Additionally, neither the new password nor the 
encryption key is the verification data recited in the claims. 

The response recited in the claims is a response associated with the verification 
data. Claim 1 recites "a response. . . associated with the verification data." Claim 14 
recites, "based on a response[,] . . . accessing verification data." Claim 31 recites "a 
response to the verification data." Claims 19 and 40 recite similar limitations. Neither 
the encryption key nor the new password is the response associated with verification data 
recited in the claims. The encryption key (e.g. 302) is not a response at all, but a stored 
value used to encrypt the new password. See Thompson, para. [0011], [0017], [0023], 
Fig. 3. 

The encryption key is not the verification data recited in the claims. The 
verification data may be challenge phrases or queries and their acceptable responses. See 
Application, p. 5, 11. 9-18. Further, the user may define queries and acceptable responses, 
and select queries to respond. See id., p. 6, 11. 2-8. Clearly, an encryption key is not a 
challenge phrase or query. The new password is also clearly not a challenge phrase and 
acceptable response. Accordingly, neither the encryption key nor the new password are 
the verification data recited in the claims. 

The new password is also not a response associated with the verification data 
recited in the present claims. As described, Thompson does not disclose verification 
data. As such, the new password cannot be associated with verification data recited in 
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the present claims. Accordingly, the new password is not the response recited in the 
present claims. 



Thus, Thompson does not anticipate the present claims because Thompson does 
not disclose the security credential, the response, and the verification data recited in 
claims 1, 14, 19, 31, and 40. Accordingly, the present claims are patentable over 
Thompson under 35 U.S.C. § 102(b). 



Conclusion 

The Appellants respectfully submit that all pending claims are in condition for 
allowance. However, if the Examiner or Board wishes to resolve any other issues by way 
of a telephone conference, the Examiner or Board is kindly invited to contact the 
undersigned attorney at the telephone number indicated below. 

Respectfully submitted, 
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